Privacy Policy

1. Who we are

Prakash Madhavan Nair, trading as NOVOBRIL (ABN 42 989 876 644), Point Cook, VIC, Australia, is the entity responsible for SmartTeam (“the Service”) and acts as the data controller (GDPR) / APP entity (Privacy Act) for personal information collected through it.

Privacy contact: prakashmnair@gmail.com

2. Scope

This policy explains how we collect, use, disclose, and protect personal information when you use my.novobril.com. It applies to all users regardless of location; supplementary rights for specific regions are set out in §11–§13.

3. What We Collect

We collect only what is necessary to provide the Service (data minimisation) and do not sell personal information.

4. How We Use It

• Provide, maintain, and improve the Service;
• Match, track, and score member contributions for profit-sharing purposes;
• Process payments and manage subscriptions, where applicable;
• Authenticate you and secure your account;
• Send transactional emails (welcome, onboarding reminders, security alerts) and, with consent, product updates;
• Provide customer support;
• Detect, investigate, and prevent fraud, abuse, or security incidents;
• Comply with legal obligations (e.g. tax record-keeping).

We do not use your personal information for unrelated secondary purposes without your consent.

5. AI Features

SmartTeam uses AI in two ways that affect your experience and, in the case of contribution scoring, your profit-sharing outcomes:

• Onboarding & profile assistance — your onboarding conversation is processed by Google Gemini (gemini-3.5-flash) via a server-side API call to extract a structured profile.
• Contribution scoring & task chat — approved activities are scored by Gemini (impact and contribution, 0–100), and the AI task chat is powered by Anthropic Claude to help you draft and generate work artifacts.

We do not send your raw account credentials or payment details to any AI model. AI conversation history and generated artifacts are stored to preserve context and are subject to the same retention and deletion rules as other account data (§8). Where an automated score affects your profit-sharing outcome, a human approver reviews the underlying activity before scoring occurs; contact us at prakashmnair@gmail.com if you wish to dispute a score.

6. Who We Share It With

We require all subprocessors to protect personal information to a standard consistent with this policy. We do not sell or rent personal information to third parties for their own marketing.

7. Overseas Disclosure

Some of the recipients in §6 store or process data outside Australia (primarily the United States). Under Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients handle your data consistently with the Australian Privacy Principles, including relying on providers with their own compliance certifications (e.g. Stripe’s PCI-DSS compliance, Google Cloud’s ISO 27001/SOC 2 certifications).

8. Data Retention & Deletion

• We retain personal information only as long as needed for the purposes in §4 or as required by law (e.g. 7-year financial record retention for tax purposes).
• Audit and security logs: retained for 7 years (audit) / 3 years (security).
• Account deletion: When you delete your account, we anonymise your records (user ID nulled, email replaced with [deleted]) rather than hard-deleting audit history, and delete or anonymise your content within a reasonable period, except where retention is legally required.

9. Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit (TLS), encrypted storage of secrets, role-based access control, and audit logging of data-changing actions. No system is completely secure; if we become aware of a data breach affecting you, we will notify you and the OAIC (where required by the Notifiable Data Breaches scheme) without undue delay.

10. Your Rights (Australian Privacy Act)

You may:

• Access the personal information we hold about you;
• Correct inaccurate or out-of-date information;
• Complain if you believe we have mishandled your information — contact us first at prakashmnair@gmail.com; if unresolved, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We will respond to access/correction requests within a reasonable period, generally 30 days.

11. Additional Rights for EU/UK/EEA Users (GDPR / UK GDPR)

If you are located in the EU, EEA, or UK, you additionally have the right to:

• Request erasure of your personal data (“right to be forgotten”), subject to legal retention obligations;
• Request restriction of processing or object to processing based on legitimate interests;
• Data portability — receive your data in a structured, machine-readable format;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with your local supervisory authority.

Legal basis for processing: contract performance (providing the Service), legitimate interests (security, fraud prevention, product improvement), consent (marketing communications, optional AI features), and legal obligation (tax records).

International transfers from the EU/UK rely on the providers’ Standard Contractual Clauses / UK IDTA where applicable.

12. Additional Rights for California Users (CCPA/CPRA)

California residents have the right to know what personal information we collect, request deletion, correct inaccurate information, and opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as defined by the CCPA/CPRA. To exercise these rights, contact prakashmnair@gmail.com. We will not discriminate against you for exercising these rights.

13. Other Jurisdictions

Compliance status for other jurisdictions (Canada/PIPEDA, Brazil/LGPD, India/DPDP, China/PIPL, Singapore/PDPA, Japan/APPI) is tracked in our docs/product/legal-compliance.md and reviewed quarterly. If a region cannot be supported compliantly, we geo-block users from that region rather than operate non-compliantly.

14. Cookies & Tracking

We use strictly necessary cookies (session/authentication) and, where enabled, analytics cookies (e.g. GA4) to understand product usage. You can control non-essential cookies via your browser settings or an in-app cookie preference control where provided.

15. Children’s Privacy

The Service is not directed at children under 16, and we do not knowingly collect personal information from them. If we learn we have inadvertently collected such data, we will delete it promptly.

16. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email or in-app notice at least 14 days before taking effect.

17. Contact Us

Prakash Madhavan Nair, trading as NOVOBRIL

ABN: 42 989 876 644

Email: prakashmnair@gmail.com

Address: Point Cook, VIC, Australia

To lodge a complaint with the Australian regulator: Office of the Australian Information Commissioner — oaic.gov.au